Policyholder Permitted To Keep Third-Party Indemnity Recovery And Be Made Whole, Instead Of Forfeiting Coverage

The recent ruling in T-Mobile USA, Inc. v. Steadfast Insurance Companysignals several good indicators for policyholders. A straight-up win for the policyholder, the case held that the insurance company could not reap the benefits of the policyholder's successful efforts to recover part of its loss from third parties. That holding alone clarifies that cyber insurance policies are meant to protect policyholders. Further, it indicates that policyholders should be made whole before insurance companies can recoup monies paid as coverage.

In the case, T-Mobile had suffered a $17.3 million loss from a cyber-security breach that was covered under its cyber insurance policy. The policy had a $10 million retention or "SIR" that T-Mobile absorbed before the policy paid the remaining $7.3 million in coverage. By pursuing its vendor for indemnity, T-Mobile recovered $10.75 million. The insurance company then claimed that it did not owe any coverage, arguing that